* Re: pyzor/spam changes in policy [not found] <200702261735.l1QHZrjX030675@localhost.localdomain> @ 2007-03-07 20:29 ` Christopher J. PeBenito 2007-03-08 14:02 ` Daniel J Walsh 0 siblings, 1 reply; 4+ messages in thread From: Christopher J. PeBenito @ 2007-03-07 20:29 UTC (permalink / raw) To: dwalsh; +Cc: selinux On Mon, 2007-02-26 at 12:35 -0500, dwalsh@localhost.localdomain wrote: > New directory for spamassin /var/lib/ > spam needs to send signals to pyzor > pyzor uses tmp files Merged most, exceptions: > +interface(`spamassassin_manage_lib_files',` > + gen_require(` > + type spamd_var_lib_t; > + ') > + > + files_search_var_lib($1) > + manage_dirs_pattern($1,spamd_var_lib_t,spamd_var_lib_t) > + manage_files_pattern($1,spamd_var_lib_t,spamd_var_lib_t) > +') Removed the dirs part. If there is an interface needed that has both, then there should be a more abstract interface. > @@ -139,6 +148,7 @@ > > tunable_policy(`spamd_enable_home_dirs',` > userdom_home_filetrans_generic_user_home_dir(spamd_t) > + userdom_manage_generic_user_home_dirs(spamd_t) > userdom_manage_generic_user_home_content_dirs(spamd_t) > userdom_manage_generic_user_home_content_files(spamd_t) > userdom_manage_generic_user_home_content_symlinks(spamd_t) I don't understand why spamd_t would be creating new top level home diretories, for example the /home/myuser dir. > @@ -184,6 +194,7 @@ > > optional_policy(` > pyzor_domtrans(spamd_t) > + pyzor_signal(spamd_t) > ') Dropped this and the following, because the interface looks wrong ($1 is the object). > +######################################## > +## <summary> > +## Send generic signals to pyzor > +## </summary> > +## <param name="domain"> > +## <summary> > +## Domain allowed access. > +## </summary> > +## </param> > +# > +interface(`pyzor_signal',` > + gen_require(` > + type pyzor_t; > + ') > + > + allow pyzor_t $1:process signal; > +') -- Chris PeBenito Tresys Technology, LLC (410) 290-1411 x150 -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: pyzor/spam changes in policy 2007-03-07 20:29 ` pyzor/spam changes in policy Christopher J. PeBenito @ 2007-03-08 14:02 ` Daniel J Walsh 2007-03-08 16:41 ` Christopher J. PeBenito 0 siblings, 1 reply; 4+ messages in thread From: Daniel J Walsh @ 2007-03-08 14:02 UTC (permalink / raw) To: Christopher J. PeBenito, SE Linux [-- Attachment #1: Type: text/plain, Size: 1871 bytes --] Christopher J. PeBenito wrote: > On Mon, 2007-02-26 at 12:35 -0500, dwalsh@localhost.localdomain wrote: > >> New directory for spamassin /var/lib/ >> spam needs to send signals to pyzor >> pyzor uses tmp files >> > > Merged most, exceptions: > > >> +interface(`spamassassin_manage_lib_files',` >> + gen_require(` >> + type spamd_var_lib_t; >> + ') >> + >> + files_search_var_lib($1) >> + manage_dirs_pattern($1,spamd_var_lib_t,spamd_var_lib_t) >> + manage_files_pattern($1,spamd_var_lib_t,spamd_var_lib_t) >> +') >> > > Removed the dirs part. If there is an interface needed that has both, > then there should be a more abstract interface. > > >> @@ -139,6 +148,7 @@ >> >> tunable_policy(`spamd_enable_home_dirs',` >> userdom_home_filetrans_generic_user_home_dir(spamd_t) >> + userdom_manage_generic_user_home_dirs(spamd_t) >> userdom_manage_generic_user_home_content_dirs(spamd_t) >> userdom_manage_generic_user_home_content_files(spamd_t) >> userdom_manage_generic_user_home_content_symlinks(spamd_t) >> > > I don't understand why spamd_t would be creating new top level home > diretories, for example the /home/myuser dir. > > https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=203290 >> @@ -184,6 +194,7 @@ >> >> optional_policy(` >> pyzor_domtrans(spamd_t) >> + pyzor_signal(spamd_t) >> ') >> > > Dropped this and the following, because the interface looks wrong ($1 is > the object). > > >> +######################################## >> +## <summary> >> +## Send generic signals to pyzor >> +## </summary> >> +## <param name="domain"> >> +## <summary> >> +## Domain allowed access. >> +## </summary> >> +## </param> >> +# >> +interface(`pyzor_signal',` >> + gen_require(` >> + type pyzor_t; >> + ') >> + >> + allow pyzor_t $1:process signal; >> +') >> > > This should be reversed, New patch [-- Attachment #2: spam.diff --] [-- Type: text/x-patch, Size: 1410 bytes --] --- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-03-08 08:26:59.000000000 -0500 +++ serefpolicy-2.5.8/policy/modules/services/spamassassin.te 2007-03-08 09:00:04.000000000 -0500 @@ -85,6 +85,7 @@ corenet_tcp_bind_all_nodes(spamd_t) corenet_tcp_bind_spamd_port(spamd_t) corenet_tcp_connect_razor_port(spamd_t) +corenet_tcp_connect_smtp_port(spamd_t) corenet_sendrecv_razor_client_packets(spamd_t) corenet_sendrecv_spamd_server_packets(spamd_t) # spamassassin 3.1 needs this for its @@ -147,6 +148,7 @@ tunable_policy(`spamd_enable_home_dirs',` userdom_home_filetrans_generic_user_home_dir(spamd_t) + userdom_manage_generic_user_home_dirs(spamd_t) userdom_manage_generic_user_home_content_dirs(spamd_t) userdom_manage_generic_user_home_content_files(spamd_t) userdom_manage_generic_user_home_content_symlinks(spamd_t) --- nsaserefpolicy/policy/modules/services/pyzor.te 2007-03-08 08:26:59.000000000 -0500 +++ serefpolicy-2.5.8/policy/modules/services/pyzor.te 2007-03-08 08:59:23.000000000 -0500 @@ -44,6 +44,8 @@ manage_dirs_pattern(pyzor_t,pyzor_tmp_t,pyzor_tmp_t) files_tmp_filetrans(pyzor_t, pyzor_tmp_t, { file dir }) +fs_search_auto_mountpoints(pyzor_t) + kernel_read_kernel_sysctls(pyzor_t) kernel_read_system_state(pyzor_t) @@ -77,6 +79,7 @@ ') optional_policy(` + spamassassin_signal_spamd(pyzor_t) spamassassin_read_spamd_tmp_files(pyzor_t) ') ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: pyzor/spam changes in policy 2007-03-08 14:02 ` Daniel J Walsh @ 2007-03-08 16:41 ` Christopher J. PeBenito 2007-03-08 16:48 ` Daniel J Walsh 0 siblings, 1 reply; 4+ messages in thread From: Christopher J. PeBenito @ 2007-03-08 16:41 UTC (permalink / raw) To: Daniel J Walsh; +Cc: SE Linux On Thu, 2007-03-08 at 09:02 -0500, Daniel J Walsh wrote: > Christopher J. PeBenito wrote: > > On Mon, 2007-02-26 at 12:35 -0500, dwalsh@localhost.localdomain wrote: > >> @@ -139,6 +148,7 @@ > >> > >> tunable_policy(`spamd_enable_home_dirs',` > >> userdom_home_filetrans_generic_user_home_dir(spamd_t) > >> + userdom_manage_generic_user_home_dirs(spamd_t) > >> userdom_manage_generic_user_home_content_dirs(spamd_t) > >> userdom_manage_generic_user_home_content_files(spamd_t) > >> userdom_manage_generic_user_home_content_symlinks(spamd_t) > >> > > > > I don't understand why spamd_t would be creating new top level home > > diretories, for example the /home/myuser dir. > > > > > https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=203290 I think this would be the correct fix: @@ -146,10 +146,10 @@ files_dontaudit_read_root_files(spamd_t) tunable_policy(`spamd_enable_home_dirs',` - userdom_home_filetrans_generic_user_home_dir(spamd_t) userdom_manage_generic_user_home_content_dirs(spamd_t) userdom_manage_generic_user_home_content_files(spamd_t) userdom_manage_generic_user_home_content_symlinks(spamd_t) + userdom_generic_user_home_dir_filetrans_generic_user_home_content(spamd_t,dir) ') ') since it is creating the ~/.spamassassin dir the filetrans user_home_dir_t -> user_home_t was missing. The filetrans that was in there did home_root_t -> user_home_dir_t. -- Chris PeBenito Tresys Technology, LLC (410) 290-1411 x150 -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: pyzor/spam changes in policy 2007-03-08 16:41 ` Christopher J. PeBenito @ 2007-03-08 16:48 ` Daniel J Walsh 0 siblings, 0 replies; 4+ messages in thread From: Daniel J Walsh @ 2007-03-08 16:48 UTC (permalink / raw) To: Christopher J. PeBenito; +Cc: SE Linux Christopher J. PeBenito wrote: > On Thu, 2007-03-08 at 09:02 -0500, Daniel J Walsh wrote: > >> Christopher J. PeBenito wrote: >> >>> On Mon, 2007-02-26 at 12:35 -0500, dwalsh@localhost.localdomain wrote: >>> >>>> @@ -139,6 +148,7 @@ >>>> >>>> tunable_policy(`spamd_enable_home_dirs',` >>>> userdom_home_filetrans_generic_user_home_dir(spamd_t) >>>> + userdom_manage_generic_user_home_dirs(spamd_t) >>>> userdom_manage_generic_user_home_content_dirs(spamd_t) >>>> userdom_manage_generic_user_home_content_files(spamd_t) >>>> userdom_manage_generic_user_home_content_symlinks(spamd_t) >>>> >>>> >>> I don't understand why spamd_t would be creating new top level home >>> diretories, for example the /home/myuser dir. >>> >>> >>> >> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=203290 >> > > I think this would be the correct fix: > > @@ -146,10 +146,10 @@ > files_dontaudit_read_root_files(spamd_t) > > tunable_policy(`spamd_enable_home_dirs',` > - userdom_home_filetrans_generic_user_home_dir(spamd_t) > userdom_manage_generic_user_home_content_dirs(spamd_t) > userdom_manage_generic_user_home_content_files(spamd_t) > userdom_manage_generic_user_home_content_symlinks(spamd_t) > + userdom_generic_user_home_dir_filetrans_generic_user_home_content(spamd_t,dir) > ') > ') > > since it is creating the ~/.spamassassin dir the filetrans > user_home_dir_t -> user_home_t was missing. The filetrans that was in > there did home_root_t -> user_home_dir_t. > > Thats ok with me. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2007-03-08 16:48 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <200702261735.l1QHZrjX030675@localhost.localdomain>
2007-03-07 20:29 ` pyzor/spam changes in policy Christopher J. PeBenito
2007-03-08 14:02 ` Daniel J Walsh
2007-03-08 16:41 ` Christopher J. PeBenito
2007-03-08 16:48 ` Daniel J Walsh
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.